1 / 74

Information Security

Information Security. Overview of Technologies & Solutions. Information Security. Introduction The Enterprise Network Defense in Depth What to protect against? Technologies & Solutions Perimeter Technologies Internal Technologies Consulting Audit, Implementation & Support. Introduction.

titus
Download Presentation

Information Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Information Security Overview of Technologies & Solutions

  2. Information Security • Introduction • The Enterprise Network • Defense in Depth • What to protect against? • Technologies & Solutions • Perimeter Technologies • Internal Technologies • Consulting • Audit, Implementation & Support

  3. Introduction The security of your network is evaluated daily, the question is… “Are you the one doing it?”

  4. Introduction • Good Information Security provides; • Data confidentiality • Ensure that no data is disclosed intentionally or unintentionally • Data integrity • Ensure that data is not modified by unauthorized personel, that no unauthorized changes are made by authorized personel, and that data remains consistent, both internally and externally • Data availability • Provide reliable and timely access to data and resources

  5. The Enterprise Network

  6. Defense in Depth • How? • Secure the perimeter • Secure the internal network • Account for the human factor • Using a layered approach: • Increases an attacker’s risk of detection • Reduces an attacker’s chance of success

  7. Defense in Depth Policies, Procedures, & Awareness Physical Security ACL, encryption Data Application Application hardening, antivirus OS hardening, update management, authentication Host Internal Network Network segments, IPSec, NIDS Firewalls, VPN quarantine,… Perimeter Guards, locks, tracking devices User education against social engineering

  8. Network Security • Network Security – focus on perimeter and Internal Network solutions Internal Network Network segments (VLANs), IPSec, NIDS, Network Access Protection, … Perimeter Firewalls, VPN, NIDS, Anti-Spam, …

  9. Why do we need Network Security? • First look at what you need to protect • Data (company resources) • Services (applications or their individually accessible parts and the people using them) • Protect against what? • Malware (Viruses, Spyware,…) • Spam (“Steals” resources and productivity) • Hackers (Network penetration, defacements, DoS Attacks,…) • Internal Users (Unauthorized access,…) • …

  10. Common Threat Classification Network Host Application Threats against the network Spoofed packets, etc. Buffer overflows, illicit paths, etc. Threats against the host SQL injection, XSS, input tampering, etc. Threats against the application

  11. Examples of Network Threats

  12. Typical Pattern of an Attack • Enter the network through SQL Injection etc. • Install or use port proxy software to open inbound connections • Remotely control the host to mount further attacks from inside until a domain controller is accessible • Gain control of the desired resources • Erase traces of attack and remove installed software

  13. How to protect yourself? • Technologies & Solutions • Secure the perimeter • Secure the internal network

  14. Perimeter Technologies • Firewall (Packet Filter, Stateful, Proxy) • Intrusion Detection System (IDS, IPS) • Virtual Private Network (IPsec, SSL) • Anti-Spam (Mail relay, AV) • Anti-Spyware (URL filtering, AV) • Anti-Virus

  15. Firewall – Static Packet Filter • Every router is a static packet filter (including your ISP router) • First incoming and last outgoing layer of your network security • Faster at screening traffic than stateful or proxy firewalls • But no knowledge of “state” thus less secure than most common firewalls

  16. Firewall – Stateful • Most common type of Firewall today • Keeps track of “state”, blocks traffic that is not in its table of established connections • Slower at screening traffic than packet filter, but more secure

  17. Firewall - Proxy • Most advanced, least common type of Firewall (is also a stateful firewall) • Higher degree of security because internal and external hosts never communicate directly • Examines the entire packet to ensure compliance with the protocol that is indicated by the destination port number

  18. Firewall – Basic theory of operation Intermediate Network (DMZ) Connection allowed External Network (Internet) Internal Network (LAN) Connection refused Firewall Divides your internal network from an external network (usually Internet) If the incoming connection is an “answer” to an outgoing connection, the connection is allowed, if not, the connection is dropped. (Stateful) Most firewalls have DMZ functionality, allowing you to further divide your network in order to supply some “Internet faced services” to your users.

  19. Firewall Solutions • Juniper (Formerly NetScreen) • Check Point

  20. Firewalls – Juniper • Integrated Firewall/IPSec VPN • NetScreen 500/200/50/25/XT/GT/HSC • Solution includes • Stateful Inspection (Perimeter defense) • Deep Inspection (Application-Level Protection) • Built-In Antivirus (Protects remote locations) • Web filtering (Prevent inappropiate web usage) • Secure Remote Acces (IPsec VPN – Secure Client)

  21. Firewalls – Check Point • Firewall • FireWall-1 • Solution includes • Comprehensive application protection • Industry-leading management • High performance

  22. Other Technologies • So if we buy a Firewall we are safe?! • Why NOT? • Weaknesses in TCP/IP suite • IP Address Spoofing • Covert Channels • IP Fragments Attacks • TCP Flags • SYN Flood • Connection Hijacking • …

  23. Intrusion Detection System • Gateway Intrusion Detection System • A network intrusion detection system which acts as a network gateway • Designed to stop malicious traffic and generate alerts on suspicious traffic • An “ideal” gateway IDS is able to stop all known exploits

  24. GIDS vs NIDS (Placement) GIDS • Acts as network gateway • Stops suspect packets • Prevents successful intrusions • False positives are VERY bad NIDS • Only observes network traffic • Logs suspect packets and generates alerts • Cannot stop an intruder • False positives are not as big of an issue

  25. IDS – Basic theory of operation • Much like a bridging firewall, IDS makes forward/drop decisions… • -This packet is always good so pass it into my network. • -This packet is always bad so drop it and tell me about it. • -This packet is sometimes bad so tell me about it, but don't drop it.

  26. IDS Solutions • Juniper • Check Point

  27. IDS – Juniper • IDS – IPS • NetScreen-IDP 10/100/500/1000 • Solution includes • Eight different detection methods are used to protect the network from network, application and hybrid attacks • Understands state to pinpoint exactly where an attack can be perpetrated and only look there • Ability to define a response action in the rulebase for detected attacks • Sub-second Stateful-failover between Juniper Networks devices without losing sessions • Enables closed loop investigation, linking directly from the log to the rule that triggered it and the session's packet capture

  28. IDS – Check Point • IDS - IPS • IntruShield • Solution includes • Unprecedented flexibility of IDS deployment, including in-line, tap, and span modes to suit any network security architecture • Thorough analysis of traffic at multi-gigabit rates that builds and maintains traffic state information and performs comprehensive protocol analysis. • Intelligent detection of known, unknown, and DoS attacks using a combination of signature, anomaly and DoS detection techniques. • Proactive capability to stop in-progress attacks coupled with a rich set of alerting and response actions. • Powerful capability to set multiple, highly granular, custom intrusion policies within a single sensor.

  29. VPN • A Virtual Private Network is a service that offers a secure, reliable connection over a shared public infrastructure such as the Internet. • Two main types; • Remote Access • Site-to-site • Two main technologies; • IPsec (and L2TP) • SSL

  30. VPN – Remote Access • Secure Remote Access for mobile users and/or home office. • Using a secure software client or hardware device for IPsec, or a webbrowser for SSL based VPN • If you able to connect to the Internet, you are able to connect to the corporate network

  31. VPN – Site-to-Site • Valid replacement for leased lines and Frame Relay connections to connect different sites. • Using specialized VPN devices or built-in into a firewall • If both your sites have Internet connectivity, they can be connected using VPN

  32. VPN – Basic theory of operation Site-to-Site VPN Remote Access A VPN tunnel is setup using a secure client or SSL capable webbrowser, all data send through the tunnel is encrypted, the packets can still be captured, but if they are they are encrypted.

  33. VPN - IPsec • Usually employs custom software at each of the endpoints – the device and the client • Normally utilizes OSI Layer 3 Protocols (AH – ESP) • Authentication Header provides two-way device authentication (implemented in hard- or software) • Encapsulation Security Payload protocol provides data encryption (3DES, AES)

  34. VPN – SSL • Employs Webbrowser at the client side and a device at the corporate side • SSL is an network Layer Protocol • SSL uses Certificates to prove the identities of both endpoints • All trafic is encrypted using a shared key and a negotiated encryption algorithm (3DES, AES)

  35. VPN Solutions • Juniper • Check Point

  36. VPN – Juniper • IPsec VPN • Built-in to firewall range of products • Solution includes • Secure client enables adherens to security policy • SSL VPN • NetScreen-RA 500, NetScreen-SA 1000/3000/5000 • Solution includes • Secure access for remote/mobile employees, with no client software required • Secure LAN, intranet, and extranet access for employees, business partners, and customers • Hardware-based SSL acceleration • Hardware-based HTTP compression • Dynamic access privilege management, with three access methods

  37. VPN – Check Point • IPsec VPN • VPN-1, VPN-1 Edge, VPN-1 VSX • Solution includes • Simple VPN deployment • Highest level of security • Easy-to-use centralized management • Unparalleled performance • High availability • SSL VPN • SSL Network Extender • Solution includes • Network-level connectivity over SSL VPN • Support for all IP-based applications • Combined IPSec and SSL VPN solution • Integrated with Check Point VPN-1

  38. Anti-Spam (Spam Firewall) • Acts as a mailrelay server – accepts incoming mail, scans the content and forwards the mail to the back-end mailserver. • Usually in combination with an Antivirus scanning engine to deliver spam- and virus-free e-mail. • Prevents direct access to your e-mail server

  39. Anti-Spam (Spam Firewall)

  40. Anti-Spam – Basic theory of operation • E-mail is delivered to the Spam Firewall • E-mail is checked against IP Block Lists, Antivirus scanning is performed, user rules are applied, spam fingerprint, intention analysis, Bayesian analysis and rule-based scoring checks are performed • Clean E-Mail is relayed to internal mailserver

  41. Anti-Spam Solutions • Barracuda • Trend Micro

  42. Anti-Spam – Barracuda • Anti-Spam Firewall • 200/300/400/600/800 • Outbound Mode • 200/300/400/600/800 • Solution Includes • Spam Filter • Content Based Filtering • Bayesian Algorithms • Denial of Service Protection • Anti-Spoofing • Anti-Phising • Virus Filter • Dual-Layer Virus Blocking • Decompression of Archives • File Type Blocking

  43. Anti-Spam – Trend Micro • Anti-Spam • Spam Prevention Solution (SPS 2.0) • Solution includes • Advanced Filtering, Analysis, and Updating Capabilities • Comprehensive Reporting and Auditing • Dynamic, Flexible Heuristic Technology • Ease of Administration and Configuration • High Performance and Scalability • Seamless Integration with Antivirus and Content Security Offerings

  44. Anti-Spyware (Gateway) • Gateway device to stop spyware installations, block spyware sites and scan for spyware signatures • Some solutions can detect spyware on user desktops and target them for cleaning • Usually combined with Antivirus solutions

  45. Anti-Spyware – Basic theory of operation If a user requests access to a website, the device checks if the site is listed in the known spyware sites list, if not the request is proxied. The content of the requested site then is scanned for spyware (and viruses) if the content is Spyware and virus free it is delivered to the client, if not it is dropped.

  46. Anti-Spyware Solutions • BlueCoat • Barracuda

  47. Anti-Spyware – BlueCoat • Anti-Spyware • Spyware Interceptor • ProxySG + ProxyAV • Solution includes • Easy, affordable, and effective spyware prevention • Automatically updates spyware profiles, policies, and prevention techniques. • Backed by world-leading experts in web proxy performance and security at Blue Coat Labs™

  48. Anti-Spyware – Barracuda • Anti-Spyware • Spyware Firewall 210/310/410 • Solution includes • Stops spyware downloads (including drive-by downloads) • Stops virus downloads • Blocks access to spyware websites • Detects spyware access to the Internet • Facilitates spyware removal • Website Category blocking • Content Inspection • Flexible Policy Enforcement

  49. Antivirus (Gateway) • Provides Internet gateway protection against viruses (http, ftp, smtp traffic) • If combined with internal antivirus solution provides dual layer protection (different vendors) • Usually a combination of Anti-Spyware, Anti-Virus and Anti-Spam on the gateway

  50. Anti-Virus (Gateway) – Basic theory of operation Requested webcontent is scanned with antivirs engine on the proxy server Clean content is delivered to the clients.

More Related